Model interaction method based on input data protection and input data protection method

Abstract

The application discloses a model interaction method and an input data protection method based on input data protection. The model interaction method comprises the following steps: a local device splits input information of a user into a plurality of text segments, encrypts each segment according to importance, and then obtains all the encrypted text segments; then, similar camouflage segments are generated, each camouflage segment is encrypted and marked by using an independent key; the encrypted camouflage and the text segments are fused into target data and sent to a cloud large language model; the target data is verified for integrity, source legality and content integrity by a receiving end of the cloud large language model, and the restored input information is obtained after all the verifications are passed; finally, a processing end processes the restored input information to generate feedback content. The method can ensure the security of user data and the effectiveness of interaction results in the information interaction process, and ensure that user private data and sensitive information are not leaked and outflowed when accessing a third-party large language model.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a model interaction method and an input data protection method based on input data protection. Background Technology

[0002] With the rapid development of artificial intelligence technology, the deployment of large language models (LLM) on public cloud platforms is becoming increasingly common. Public cloud provides convenient infrastructure and powerful computing capabilities for the application of large language models, enabling more users and enterprises to carry out various business and innovation activities with the help of these models.

[0003] However, the application of large language models in the current public cloud environment faces many serious problems. One is information security risk. In the public cloud environment, for example, when uploading data to the large language model APP through mobile devices, for industries with extremely high requirements for data confidentiality, such as the legal and medical fields, there is a possibility that the user input data and the model output content may be maliciously intercepted or misused. This could lead to the leakage of user privacy and the outflow of sensitive information, and even cause serious losses to customers. Summary of the Invention

[0004] In view of this, the present disclosure provides a model interaction method and an input data protection method based on input data protection, which can solve the problems of leakage of user private data and outflow of sensitive information in the prior art when accessing third-party large language models.

[0005] In a first aspect, embodiments of this disclosure provide a model interaction method based on input data protection, comprising:

[0006] In response to a question-and-answer request, the user's input information is split into several text segments on the local device, and the corresponding level of encryption policy is invoked and encryption is performed according to the importance of each text segment;

[0007] Generate several disguised fragments that are similar in distribution to all the encrypted text fragments;

[0008] Each of the spoofed fragments is encrypted with an independent encryption key, and the spoofed fragments are marked using a preset method;

[0009] According to the preset fusion rules, all the encrypted disguised fragments are fused with all the encrypted text fragments to obtain the target data;

[0010] The target data is sent to the cloud-based large language model;

[0011] The target data is verified for data integrity, source legality, and content integrity by the receiving end of the cloud-based large language model. Once all verifications are passed, the restored input information is obtained.

[0012] The cloud-based large language model is invoked to process the recovered input information and generate the required feedback content.

[0013] Secondly, this disclosure also provides an input data protection method for input data protection in a public cloud environment, the method comprising:

[0014] In response to a question-and-answer request, the user's input information is split into several text segments on the local device, and the corresponding level of encryption policy is invoked and encryption is performed according to the importance of each text segment;

[0015] Generate several disguised fragments that are similar in distribution to all the encrypted text fragments;

[0016] Each of the spoofed fragments is encrypted with an independent encryption key, and the spoofed fragments are marked using a preset method;

[0017] According to the preset fusion rules, all the encrypted disguised fragments are fused with all the encrypted text fragments to obtain the privacy-protected input data.

[0018] Secondly, embodiments of this disclosure also provide a privacy protection architecture for input data of a large language model, deployed around the large language model, the architecture comprising:

[0019] The receiving unit is used to receive user input information;

[0020] The dynamic segmentation encryption unit is used to split the input information into several text segments, call the corresponding level of encryption strategy according to the importance of each text segment and perform encryption, and obtain all the encrypted text segments, which are recorded as encrypted data;

[0021] The disguised fragment generation unit is used to generate several disguised fragments that are similar to the distribution of all encrypted text fragments;

[0022] The disguised fragment encryption unit is used to encrypt each of the disguised fragments using an independent encryption key and to mark the disguised fragments using a preset method;

[0023] The fusion unit is used to fuse all the encrypted disguised fragments with all the encrypted text fragments according to a preset fusion rule to obtain the target data;

[0024] The sending unit is equipped with API interfaces adapted to various large language models, which are used to send target data to the receiving end of the corresponding large language model in the cloud.

[0025] Fourthly, this disclosure also provides a computer device, which adopts the following technical solution:

[0026] The computer device includes:

[0027] At least one processor; and,

[0028] A memory communicatively connected to the at least one processor; wherein,

[0029] The memory stores instructions that can be executed by the at least one processor, which enable the at least one processor to perform either the input data protection-based model interaction method or the input data protection method described above.

[0030] Fifthly, embodiments of this disclosure also provide a computer-readable storage medium storing computer instructions for causing a computer to execute any of the above-described input data protection-based model interaction methods or the input data protection methods.

[0031] Sixthly, embodiments of this disclosure also provide a computer program product, including a computer program / instructions that, when executed by a processor, implement the steps of any of the methods described above.

[0032] The model interaction method based on input data protection disclosed in this application, in response to a question-and-answer request, splits the user's input information into several text fragments on the local device. Based on the importance of each text fragment, it calls and executes encryption strategies of corresponding levels, enabling targeted protection of key information. Then, it acquires all encrypted text fragments and generates several disguised fragments with a similar distribution to the encrypted text fragments. Each disguised fragment is encrypted using an independent encryption key and marked using a preset method. According to a preset fusion rule, all encrypted disguised fragments are fused with all encrypted text fragments to obtain the target data, increasing the confidentiality of data transmission and making the information more difficult to steal and crack during transmission. The target data is sent to a cloud-based large language model, where the receiving end of the cloud-based large language model verifies the target data's integrity, source legitimacy, and content integrity. Once all verifications pass, the recovered input information is obtained, ensuring the accuracy and reliability of the received information and preventing data errors or tampering from affecting the processing results. Finally, the processing end of the cloud-based large language model is called to process the recovered input information and generate the required feedback content. This method can ensure the security of user data and the validity of interaction results during information exchange, and guarantee that users' private data and sensitive information are not leaked when accessing third-party large language models.

[0033] The above description is merely an overview of the technical solution disclosed herein. In order to better understand the technical means of this disclosure and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this disclosure more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0034] To more clearly illustrate the technical solutions of the embodiments of this disclosure, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a flowchart illustrating the model interaction method based on input data protection provided in an embodiment of this disclosure.

[0036] Figure 2 This is a flowchart illustrating a method for generating camouflaged segments according to an embodiment of the present disclosure.

[0037] Figure 3 This is a flowchart illustrating the method for acquiring target data provided in an embodiment of this disclosure.

[0038] Figure 4This is a flowchart illustrating the method for obtaining recovered input information provided in an embodiment of this disclosure.

[0039] Figure 5 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present disclosure. Detailed Implementation

[0040] The embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0041] It should be understood that the following specific examples illustrate the implementation of this disclosure, and those skilled in the art can easily understand other advantages and effects of this disclosure from the content disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of this disclosure, and not all of them. This disclosure can also be implemented or applied through other different specific implementation methods, and the details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this disclosure. It should be noted that, in the absence of conflict, the following embodiments and features in the embodiments can be combined with each other. Based on the embodiments in this disclosure, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this disclosure.

[0042] It should be noted that various aspects of embodiments within the scope of the appended claims are described below. It will be apparent that the aspects described herein can be embodied in a wide variety of forms, and any particular structure and / or function described herein is merely illustrative. Based on this disclosure, those skilled in the art will understand that one aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects set forth herein can be used to implement the device and / or practice the method. Additionally, this device and / or method can be implemented using structures and / or functionalities other than one or more of the aspects set forth herein.

[0043] It should also be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this disclosure. The drawings only show the components related to this disclosure and are not drawn according to the number, shape and size of the components in actual implementation. In actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0044] Furthermore, specific details are provided in the following description to facilitate a thorough understanding of the examples. However, those skilled in the art will understand that the described aspects can be practiced without these specific details.

[0045] Reference Figure 1This application discloses a model interaction method based on input data protection, which specifically includes:

[0046] S100, in response to a question-and-answer request, splits the user's input information into several text fragments on the local device, calls the corresponding level of encryption policy according to the importance of each text fragment, and performs encryption.

[0047] Retrieve all encrypted text fragments.

[0048] Suppose the user inputs a document about a confidential business project. The local device breaks the document down into different text fragments based on semantics and structure, and encrypts them hierarchically according to importance. This ensures a high level of security for critical information while also improving encryption efficiency and reducing the consumption of computing resources.

[0049] The application targets areas with high confidentiality, such as the legal and medical fields; the preferred input information includes medical data, personal privacy data, or legal data.

[0050] S200 generates several disguised fragments that are similar to the distribution of all encrypted text fragments.

[0051] The generated spoofed fragments appear to be legitimate queries or statements on the surface, but actually contain no meaningful information. The existence of spoofed fragments can confuse attackers, making it difficult for them to distinguish between real text fragments and spoofed fragments, thus increasing data security.

[0052] S300 encrypts each spoofed fragment with an independent encryption key and marks the spoofed fragment using a preset method.

[0053] Each spoofed fragment is generated with a unique symmetric encryption key, which can be encrypted using the AES algorithm. A preset marking method is to add a specific binary identifier to the header of the encrypted spoofed fragment. The meaning of this identifier can only be known by the local device and the cloud-based large language model.

[0054] Independent encryption keys increase the security of spoofed fragments. Even if the key of one spoofed fragment is cracked, it will not affect other spoofed fragments. The tagging method facilitates the subsequent identification of spoofed fragments by a large language model in the cloud.

[0055] S400 merges all encrypted disguised fragments with all encrypted text fragments according to preset fusion rules to obtain the target data.

[0056] The fusion process incorporates techniques such as shuffling the data, randomizing its location, and adding obfuscated information to effectively resist traffic analysis attacks. To verify the camouflage effect, methods such as information entropy analysis, traffic pattern analysis, and statistical correlation tests can be performed to ensure that the mixed data stream is indistinguishable from real content to an external observer. The fused target data makes it more difficult for attackers to extract the real text fragments, further enhancing data confidentiality.

[0057] S500 sends the target data to the cloud-based large language model;

[0058] The target data is verified for data integrity, source legality, and content integrity by the receiving end of the cloud-based large language model. Once all verifications are passed, the restored input information is obtained.

[0059] The large language model includes any one of ChatGPT, DeepSeek, Wenxin Yiyan, Grok, and Doubao Kimi.

[0060] Specifically, the local device sends the target data to the cloud-based large language model via a secure network channel (such as HTTPS). The receiving end of the cloud-based large language model first verifies data integrity by calculating a hash value to ensure that the data has not been tampered with during transmission; it verifies the legitimacy of the source by checking the sender's digital signature; it compares the content of the decrypted text fragments to verify content integrity; and after all verifications pass, it removes counterfeit fragments based on the marking information, decrypts the text fragments, and reassembles them to obtain the recovered input information. This data verification process ensures that the received data is complete, legitimate, and tamper-proof, providing a reliable foundation for subsequent processing and ensuring the security of data interaction.

[0061] The S600 calls the cloud-based large language model processing end to process the recovered input information and generate the required feedback content.

[0062] For example, if the recovered input is a market analysis question about a business project, the cloud-based large language model's processing end analyzes and answers the question based on its own knowledge and algorithms, generating a detailed market analysis report and recommendations as feedback. Leveraging the powerful processing capabilities and rich knowledge reserves of the cloud-based large language model, it can provide users with high-quality and accurate feedback to meet their needs.

[0063] The model interaction method based on input data protection disclosed in this application effectively protects the security of user input information and prevents data from being stolen or tampered with during transmission and processing through a series of measures such as hierarchical encryption, disguised fragments, fusion processing, and multi-dimensional verification. The existence of disguised fragments makes the real information more concealed, further protecting user privacy. Local devices improve encryption efficiency by grading encryption according to importance, while the powerful processing capabilities of cloud-based large language models ensure the generation of high-quality feedback content, achieving an overall balance between efficiency and quality. It can be used in conjunction with various mainstream large language models (such as ChatGPT, DeepSeek, and Wenxin Yiyan), and has wide applicability.

[0064] In this application, the encryption strategy is dynamically adjusted according to the data context, which improves both security and optimizes computational efficiency. Through dynamic fragmentation, a combination of encryption with different strengths and spoofing injection, adaptive protection for sensitivity is achieved, providing the highest level of security while maintaining low latency.

[0065] The S100 method, which "splits user input information into several text fragments on a local device, calls the corresponding level of encryption policy based on the importance of each text fragment, and performs encryption," specifically includes:

[0066] The A100 uses natural language processing technology on the local device to break down the user's input information into several text segments.

[0067] Breaking the input information into text fragments allows for more detailed processing and analysis. Different fragments may have different sensitivities and importance, facilitating subsequent individual processing and encryption of each fragment.

[0068] A200 uses natural language processing algorithms to perform keyword analysis on each text segment and determine the sensitivity level of each text segment.

[0069] For example, in legal documents, segments containing key clauses and information about the parties' identities have a high sensitivity level; in medical data, segments such as patients' diagnoses and allergy histories have a high sensitivity level. Sensitivity levels can be categorized as Level 1 Importance, Level 2 Importance, or Ordinary Importance.

[0070] By comprehensively evaluating the sensitivity level of text fragments using multiple methods, the importance of each fragment can be more accurately determined, thus providing a basis for selecting appropriate encryption strategies.

[0071] The A300 retrieves the corresponding encryption strategy from the encryption strength level database based on each sensitivity level.

[0072] Specifically, different semantic importance and encryption strength configuration schemes are used. If it is greater than 0.8, it is the highest sensitivity; if it is between 0.5 and 0.8, it is sensitive; and if it is below 0.5, it is normal.

[0073] When the sensitivity level is level 1, the corresponding encryption strategy is level 1 encryption strategy; when the sensitivity level is level 2, the corresponding encryption strategy is level 2 encryption strategy; when the sensitivity level is level 3, the corresponding encryption strategy is level 3 encryption strategy.

[0074] Choosing the appropriate encryption strategy based on different sensitivity levels can ensure the security of important information while avoiding the use of overly complex encryption algorithms for ordinary information, thus improving encryption efficiency.

[0075] The A400 encrypts text fragments according to the corresponding encryption policy and digitally signs the metadata of each text fragment using a preset private key.

[0076] Specifically, the preferred first-level encryption strategy includes the post-quantum-secure Kyber-1024 encryption algorithm; the preferred second-level encryption strategy includes the AES-256-GCM encryption algorithm; and the preferred third-level encryption strategy includes the ChaCha20-Poly1305 encryption algorithm.

[0077] Encryption can protect the content of text fragments from being illegally obtained and tampered with, while digital signatures can ensure the integrity and authenticity of metadata, preventing metadata from being forged or tampered with, thus providing double protection for data security.

[0078] In this embodiment, different encryption strategies are adopted according to different sensitivity levels, which can provide high-strength encryption for important information and effectively protect users' medical data, personal privacy data, and legal data. For ordinary information, a relatively simple encryption algorithm is used, avoiding the inefficiency caused by using high-strength encryption algorithms for all information, thus improving processing efficiency while ensuring data security. Digital signatures are used to protect the metadata of text fragments, ensuring the integrity and authenticity of the metadata and providing a guarantee for the trustworthiness of the data.

[0079] Reference Figure 2 The method for S200, which "generates several disguised fragments that are similar in distribution to all encrypted text fragments," specifically includes the following methods for generating disguised fragments:

[0080] S210, extract features for each encrypted text segment to obtain the corresponding target features, and convert the target features into a high-dimensional feature vector;

[0081] Store the high-dimensional feature vectors corresponding to all encrypted text fragments into the first vector set.

[0082] In this step, the extracted features are semantic features, which include word frequency distribution, sentence structure, and topic orientation.

[0083] Specifically, suppose we have three encrypted text segments: "Encrypted Information 1", "Encrypted Information 2", and "Encrypted Information 3". We can use the TF-IDF (Term Frequency-Inverse Document Frequency) method to extract features from each encrypted text segment; TF-IDF calculates the importance of each word in the text segment. For example, for "Encrypted Information 1", we extract some keywords and their corresponding TF-IDF values, and combine these values ​​to form the target features. Then, we use techniques such as Word2Vec to convert these target features into high-dimensional feature vectors. Assuming the converted vectors have a dimension of 300, we store the 300-dimensional feature vectors corresponding to the three encrypted text segments in a first vector set.

[0084] By extracting features and converting them into high-dimensional feature vectors, text fragments can be transformed into numerical representations that computers can process, facilitating subsequent training of machine learning models. Simultaneously, high-dimensional feature vectors can better capture the semantic information of the text, improving the accuracy of the model.

[0085] S220: Divide all high-dimensional feature vectors in the first vector set to obtain several batches;

[0086] The high-dimensional feature vectors corresponding to several batches are used as input to the variational autoencoder. The parameters of the variational autoencoder are iteratively updated using the stochastic gradient descent method. The trained variational autoencoder is obtained when the preset loss function is minimized.

[0087] Suppose the first vector set contains 100 high-dimensional feature vectors, which can be divided into 10 batches, each containing 10 feature vectors. These high-dimensional feature vectors from each batch are used as input to a variational autoencoder (VAE). The VAE consists of an encoder and a decoder. The encoder maps the input feature vectors to the latent space, and the decoder reconstructs the original feature vectors from the vectors in the latent space. The parameters of the VAE are iteratively updated using stochastic gradient descent. In each iteration, a pre-defined loss function is calculated. This pre-defined loss function typically includes reconstruction loss and KL divergence loss. The reconstruction loss measures the difference between the reconstructed feature vectors and the original feature vectors, while the KL divergence loss measures the difference between the distribution of the latent space and the standard normal distribution. The iteration stops when the pre-defined loss function is minimized, resulting in a trained VAE. Dividing the high-dimensional feature vectors into batches for training improves training efficiency and reduces memory usage. Stochastic gradient descent effectively updates the parameters of the VAE, enabling the model to learn the feature distribution of the encrypted text fragments.

[0088] Specifically, in each training epoch, each batch is processed sequentially, the loss function is calculated and the parameters are updated until the preset loss function L reaches its minimum value, thus obtaining the trained variational autoencoder.

[0089] Specifically, the method in S220 that "iteratively updates the parameters of the variational autoencoder using stochastic gradient descent" includes:

[0090] 1) Initialize the parameters of the encoder network and decoder network of the variational autoencoder.

[0091] Specifically, the high-dimensional feature vector is input into the initialized variational autoencoder, and the initialized encoder network maps the high-dimensional feature vector to the mean and log-variance of the latent space.

[0092] 2) Determine the preset loss function; the preset loss function is L: , To reconstruct the loss, For KL divergence loss;

[0093] ; .in, This is the original input sample; The sample output by the decoder, i.e., the reconstructed sample; The number of samples; Let be the i-th dimension of the encoder output; Let be the mean value of the i-th dimension of the encoder output.

[0094] 3) Use stochastic gradient descent to iteratively update the parameters of the initialized variational autoencoder. When the preset loss function is minimized, the trained variational autoencoder is obtained.

[0095] S230, based on the preset number of camouflaged segments, uses a random number generator to sample M latent vectors from the latent space of the trained variational autoencoder.

[0096] The preset number of spoofed segments is M, and the prior distribution of the latent space of the trained variational autoencoder is a standard normal distribution (N(0,I), where I is the identity matrix). Sampling latent vectors from the standard normal distribution ensures that the generated spoofed segments have a similar distribution to the encrypted text segments, increasing the realism of the spoofing.

[0097] Furthermore, the ratio of disguised fragments to real text fragments is preset to 3:1. Of course, the ratio can be dynamically adjusted according to security requirements to ensure that the generated disguises are indistinguishable from real data in information entropy analysis, traffic pattern analysis, and statistical correlation tests.

[0098] S240, the latent vector is input into the trained decoder network to obtain M reconstructed feature vectors.

[0099] The decoder network can transform latent vectors into reconstructed feature vectors that are similar to the features of encrypted text fragments, providing a basis for generating disguised fragments.

[0100] S250 converts all the reconstructed feature vectors back to text representation to obtain M disguised fragments.

[0101] In this context, disguised fragments may appear to be reasonable queries or statements on the surface, but they do not contain meaningful information.

[0102] Specifically, the reconstructed feature vectors are converted back to text representation using a process that is the reverse of feature extraction. For example, if TF-IDF and Word2Vec were used during feature extraction, the values ​​in the reconstructed feature vectors can be restored to their corresponding keywords based on the Word2Vec word vector table and the TF-IDF weights. These keywords are then combined into text to obtain M disguised fragments. Converting the reconstructed feature vectors back to text representation allows the generated disguised fragments to be directly mixed with encrypted text fragments, increasing the data's obfuscation.

[0103] In this embodiment, the generated disguised fragments are similar in distribution to the encrypted text fragments, which can effectively confuse attackers, making it difficult for them to distinguish between real encrypted text fragments and disguised fragments, thereby improving data security. With the addition of disguised fragments, even if attackers obtain some data, they cannot determine which data is real encrypted data, thus protecting user privacy. The existence of disguised fragments increases the difficulty for attackers to crack the data, reduces the risk of data leakage, and improves the data's resistance to attacks.

[0104] The S300 method of "encrypting each spoofed fragment with an independent encryption key and marking the spoofed fragment using a preset method" specifically includes:

[0105] S310, for each camouflage fragment (p i Generate a key pair (PK) i SK i The key includes a public key and a private key used for deception, where PK... i Used for encryption, SK i Used for decryption.

[0106] Specifically, the RSA algorithm can be used to generate a key pair for each spoofed fragment; encrypting each spoofed fragment with an independent key pair improves encryption security, ensuring that even if one key pair is cracked, the security of other spoofed fragments remains unaffected. Different key pairs increase the difficulty for attackers to crack all spoofed fragments, enhancing the overall confidentiality of the data.

[0107] S320, using a fake public key (PK) i For each camouflaged fragment (p) i All fragments are encrypted, and the encrypted fake fragments are recorded as fake encrypted fragments.

[0108] Using public-key encryption ensures that only the person holding the corresponding private key can decrypt the disguised fragment; during data transmission or storage, even if the disguised encrypted fragment is intercepted, the attacker cannot access its content without the private key, further protecting the privacy of the disguised fragment.

[0109] S330, calculate each disguised encrypted fragment (e pi The hash value (h) i =H(e pi ));

[0110] Generate a random number (r) using a random number generator. i ) ;

[0111] The hash value is combined with a random number to form the target information, and the target information is used to mark the corresponding disguised fragment.

[0112] The target information is t. i : t i =h i ⊕r i , where h i For hash value, r i is the corresponding random number, where ⊕ represents the XOR operation.

[0113] Specifically, a 128-bit random number is generated using the operating system's random number generator. This random number is different each time it is generated, exhibiting high randomness. The addition of a random number increases the randomness and unpredictability of the tagging information, making it difficult for attackers to guess the generation rules and thus further enhancing data security. By combining hash values ​​and random arrays to create the target information for tagging, each disguised encrypted fragment can be accurately identified. This also increases the complexity of the tagging; even if an attacker obtains the tagging information, the presence of the random number makes it difficult to extract useful information, thereby improving the security of the tagging.

[0114] In this embodiment, each disguised fragment is encrypted using an independent key pair, preventing the risk of multiple disguised fragments being cracked due to key leakage; the combination of hash value and random number marking further increases the confidentiality and integrity of the data, making it more difficult for attackers to obtain and tamper with the disguised fragments; by marking the disguised fragments with target information, each disguised fragment can be easily identified and distinguished when it is necessary to manage, retrieve or verify the disguised fragments, improving the efficiency of data management; the introduction of random numbers and complex marking methods increase the difficulty for attackers to crack the data, reduce the possibility of data leakage and tampering, and enhance the data's resistance to attacks.

[0115] In addition, the "internal tagging" method can also be used for "marking the disguised fragments using a preset method". That is, the metadata identifier (such as a hash checksum derived from the key) is embedded in the encrypted disguised fragment. Specifically, it includes: 1) Generating the tag: calculating the HMAC of the disguised fragment content (the key is the disguised special key); 2) Embedding method: attaching the tag as encrypted metadata (without changing the core content of the fragment), and the position is dynamically offset based on the key hash (e.g., offset = hash mod length); 3) Integration and mixing strategy: after the tag is embedded, the order is shuffled and the positioning is randomized when it is merged with the real fragment.

[0116] In this embodiment, regardless of the marking method used, the mark is invisible to external observers. The invisibility mechanism: the mark exists only in internal metadata and does not change the visible characters, length, or surface distribution of the fragment (external observers cannot detect it with the naked eye or simple scanning). The mark requires a specific key to extract (keyless extraction has a 100% failure rate), and is verified using zero-knowledge proofs to ensure that even if the fragment is intercepted, the existence of the mark cannot be confirmed; the system uses information entropy analysis to ensure that the mixed data stream is indistinguishable externally (matching the appendix: this mark is invisible to external observers).

[0117] Reference Figure 3 The S400 method of "merging all encrypted disguised fragments with all encrypted text fragments according to preset fusion rules to obtain target data," i.e., the method for obtaining target data, specifically includes:

[0118] S410, determine the first sequence of all encrypted text fragments according to the first preset rule.

[0119] Specifically, the first preset rule can be to sort the text fragments according to their length, from shortest to longest. Of course, it can also be sorted according to other preset rules to obtain the first sequence. By sorting the text fragments, an ordered foundation can be provided for the subsequent insertion of spoofed fragments, making the entire fusion process more controllable and predictable. At the same time, choosing an appropriate sorting rule can optimize the data structure according to actual needs. For example, in some cases, sorting by length can make the data easier to analyze in subsequent processing.

[0120] S420, determine the second sequence of all encrypted disguised fragments according to the second preset rule.

[0121] Specifically, the second preset rule can be to sort the camouflaged fragments according to their length, from shortest to longest. Of course, it can also be sorted according to other preset rules to obtain the second sequence. Sorting the camouflaged fragments helps maintain a certain order when determining the insertion position, avoiding chaos in the insertion process. Using hash value sorting can take advantage of the uniqueness and determinism of hash values, so that each camouflaged fragment has a stable position in the sequence, which is convenient for subsequent offset calculation and insertion operations.

[0122] S430, obtain the hash value of each encrypted spoofed fragment, and record it as the spoofed hash value.

[0123] For example, for the encrypted spoofed fragments X, Y, and Z, their hash values ​​are calculated using a common hash algorithm such as SHA-256. Assume the hash value of X (the spoofed hash value) is 0x123456789abcdef, the hash value of Y is 0x23456789abcdef1, and the hash value of Z is 0x3456789abcdef12. Hash values ​​are unique and deterministic; the hash value of each spoofed fragment can serve as its unique identifier. In subsequent offset calculations, the hash value can be used as an important input parameter, increasing the randomness and uniqueness of the offset calculation and making the insertion position of each spoofed fragment more unpredictable.

[0124] S440 generates a fake random number using a random number generator.

[0125] Specifically, random number generation functions in programming languages, such as the `random.randint()` function in Python, can be used to generate an integer between 1 and 100 as a fake random number. The introduction of random numbers increases the randomness of the fusion process, making the insertion position of the fake fragment more difficult to predict. Attackers cannot accurately deduce the insertion position of the fake fragment based on known text fragments and information about the fake fragment, thus improving data security.

[0126] S450 determines the offset of each encrypted fake fragment based on fake random numbers, fake hash values, and a preset fake formula.

[0127] By combining random numbers and hash values ​​to calculate the offset, the offset of each disguised fragment is made random and unique. Even if an attacker knows some information about the disguised fragment and the text fragment, it is difficult for them to accurately calculate the offset and insertion position due to the presence of random numbers, which further enhances the security of the data.

[0128] Specifically, no. An encrypted, disguised fragment The corresponding offset is : ,in, For the first An encrypted, disguised fragment The fake hash value, For the preset offset range, To disguise random numbers.

[0129] Among them, the modulo operation The modulo operation maps hash values ​​to the range 0 to s−1, ensuring that the base part of the offset remains within a controllable range. Specifically, the modulo operation (h mod s) can "compress" any integer h (such as a hash value) into a fixed range of 0 to s-1. The purpose of this is to distribute data within a controllable interval, facilitating subsequent processing. For example, suppose you have a hash function that calculates a very large hash value h = 123456789. Now you want to put it into a hash table with s = 1000 slots. By using 123456789 mod 1000, you get 789. This tells you that this hash value should be placed in slot 789 of the hash table (index starts from 0). No matter how large the original hash value is, after modulo, it will fall within the range of 0 to 999, without going out of bounds. In short, the modulo operation acts like a "fence," confining arbitrarily large numbers within a fixed range to ensure that data doesn't wander off.

[0130] S460, determine the insertion position of each encrypted camouflage fragment in the first sequence based on the order of each encrypted camouflage fragment in the second sequence and the corresponding offset.

[0131] Specifically, Inserted into the first sequence One position.

[0132] The insertion position is determined by the offset, so that the disguised fragment can be inserted into the text fragment sequence in a random yet ordered manner. This ensures both the randomness of the insertion of the disguised fragment and the regularity of the entire insertion process, which facilitates subsequent data processing and recovery.

[0133] S470, based on the insertion position, perform camouflage injection of the corresponding encrypted camouflage fragment in the first sequence until the injection of all encrypted camouflage fragments is completed, and then obtain the target data.

[0134] By inserting spoofed fragments into a sequence of text fragments, the spoofed data and text data are fused together. This allows the spoofed fragments to be hidden within the text fragments during data transmission or storage, increasing data security and concealment, and making it difficult for attackers to distinguish between real text data and spoofed data.

[0135] The method disclosed in this embodiment, by introducing random numbers and hash values, makes the insertion position of the disguised fragment difficult to predict, making it impossible for attackers to easily identify and extract the disguised data, thereby protecting the confidentiality of the data; by fusing the disguised fragment into the text fragment, the disguised data can be hidden in the normal data, making it difficult to be detected, thus increasing the security and anti-attack capability of the data; through preset rules and formulas, the entire fusion process has a certain regularity and predictability, which facilitates data processing and recovery when needed, and also makes it easy to adjust and optimize the fusion process.

[0136] The method for "sending target data to the cloud-based large language model" in S500 specifically includes:

[0137] A100 divides the target data into multiple data blocks, calculates the hash value for each data block, and forms a hash list.

[0138] For each data block, a common hash algorithm (such as SHA-256) can be used to calculate its hash value. Taking the first data block as an example, it is input into the SHA-256 hash function. After a series of calculation steps (such as message padding, data grouping, and cyclic compression), a 256-bit hash value is finally obtained. This operation is performed on all data blocks, and the resulting hash values ​​are arranged in order to form a hash list.

[0139] Hash values ​​are unique; if even a single bit of the content of a data block changes, its hash value will be completely different. Therefore, during subsequent transmission and processing, the hash value of the data block can be recalculated and compared with the original hash list to verify whether the data has been tampered with. Dividing large amounts of target data into smaller data blocks reduces processing complexity. At the same time, the hash list can serve as a concise representation of the data block, facilitating subsequent operations such as constructing Merkle trees.

[0140] The A200 constructs a Merkle tree at the sending end of the local device based on a hash list. The Merkle tree is a binary tree structure, where each leaf node is the hash value of a data block, and the non-leaf nodes are the hash values ​​of the two child nodes. The root node hash value (Merkle root) represents the summary of the entire target data.

[0141] Specifically, suppose the hash list is [H1, H2, H3, H4, H5, H6, H7, H8, H9, H10]. First, these hash values ​​are used as leaf nodes of the Merkle tree. Then, they are paired from left to right, and their hash values ​​are calculated to form parent nodes. For example, calculating the hash values ​​of H1 and H2 yields P1, calculating the hash values ​​of H3 and H4 yields P2, and so on. If the number of nodes is odd, the last node is combined with itself to calculate its hash value. Then, the newly generated parent nodes are paired again to calculate their hash values, forming higher-level nodes. This process is repeated until a root node, the Merkle root, is finally obtained.

[0142] When verifying data, it's unnecessary to verify the entire target data; only the Merkle tree nodes relevant to the target data need to be verified. For example, to verify whether a data block belongs to the target data, only the hash value corresponding to that data block and the hash values ​​of all nodes along the path from that node to the Merkle root need to be provided. By calculating the hash values ​​level by level and comparing them with the Merkle root, the integrity of the data can be quickly verified, greatly reducing the amount of computation and data transmission required for verification. The Merkle root can serve as a concise summary of the entire target data. By comparing whether the Merkle roots are consistent, it can be determined whether two sets of target data are identical, without needing to compare the entire data content.

[0143] In the A300, the sending end of the local device uses a zero-knowledge proof protocol to generate a zero-knowledge proof about Merklegen.

[0144] The zero-knowledge proof protocol can be zk-SNARKs or zk-STARKs.

[0145] Specifically, taking zk-SNARKs as an example, the sending end needs to complete the following main steps: 1) Setup phase: Generate public parameters, including proof keys and verification keys. These parameters are generated based on specific mathematical principles and algorithms and are used for subsequent proof and verification processes; 2) Proof phase: The sending end uses the proof key, combined with Merkle root and relevant information of the target data, to generate a zero-knowledge proof through a series of mathematical operations (such as polynomial commitments, pairwise operations, etc.). This proof indicates that the sending end knows the specific content of the target data, but does not reveal the data itself; 3) Verification phase: At the receiving end, the zero-knowledge proof is verified using the verification key. The verification process mainly checks whether the proof meets specific mathematical conditions. If it does, it means that the sending end does indeed know the content of the target data.

[0146] Zero-knowledge proofs allow a receiver to verify whether a sender possesses specific data without requiring the sender to reveal the data's content. This is crucial for protecting user data privacy, especially in scenarios involving sensitive information. Because zero-knowledge proofs are based on complex mathematical principles and algorithms, they offer high security. Even if an attacker intercepts a zero-knowledge proof, they cannot extract any information about the target data from it.

[0147] The A400 packages the target data, Merkle tree, Merkle root zero-knowledge proof, and digital signature corresponding to each text fragment in the target data into a data packet and sends it to the receiving end of the large language model in the cloud.

[0148] Specifically, this data packet is sent over the network to the receiving end of the large language model in the cloud. The data packet contains a Merkle tree and a digital signature. The receiving end can verify the Merkle tree and digital signature to ensure that the data has not been tampered with during transmission and that it was indeed sent by a legitimate sender. The existence of zero-knowledge proofs allows the receiving end to verify whether the sender possesses the data without obtaining the specific content of the target data, thus satisfying the need for data privacy protection.

[0149] In this embodiment, technologies such as hash lists, Merkle trees, and digital signatures are used to ensure the integrity and authenticity of the target data during transmission and processing, preventing data from being tampered with or forged. The use of zero-knowledge proof protocols allows the sender to prove to the receiver that it owns the data without revealing the specific content of the data, thus protecting user privacy. The combination of Merkle trees and zero-knowledge proofs greatly reduces the computational and transmission volume of data verification, improving the efficiency of data processing.

[0150] Reference Figure 4The method in S500 that "verifies the data integrity, source legality, and content integrity of the target data through the receiving end of the cloud-based large language model, and obtains the restored input information after all verifications pass" specifically includes:

[0151] B100 verifies data integrity at the receiving end of the large language model in the cloud. In response to the integrity verification pass command, it extracts all encrypted text fragments from the target data.

[0152] Specifically, the data integrity of the received data packets is verified at the receiving end of the large language model in the cloud. Data integrity verification ensures that the received data is not missing or corrupted, avoiding errors in subsequent processing due to incomplete data. At the same time, separating the encrypted text fragments and retaining only the real fragments reduces the complexity of subsequent processing and improves processing efficiency.

[0153] B200 verifies the source legitimacy of all encrypted text fragments, and decrypts all encrypted text fragments in response to a successful legitimacy verification instruction.

[0154] Source legitimacy verification can prevent data sent by unauthorized users from entering the system, avoiding data leaks and malicious attacks; the decryption operation converts the encrypted text fragments into plaintext, allowing for further processing and analysis.

[0155] B300 performs content integrity verification on all decrypted text fragments. In response to the integrity verification passing instruction, it reassembles all decrypted text fragments to obtain the recovered input information.

[0156] Content integrity verification ensures that the decrypted text fragments have not been tampered with, guaranteeing the accuracy of the recovered input information; reconstructing the decrypted text fragments yields the complete original input information, enabling its effective use later.

[0157] In this embodiment, by verifying data integrity, source legitimacy, and content integrity, it is possible to effectively prevent data from being tampered with, leaked, or maliciously attacked during transmission and processing, thus ensuring data security. The verification and validation mechanism at multiple stages can ensure that the recovered input information is consistent with the original input information, thereby improving data accuracy. In each step, only necessary data is processed, removing interfering information, reducing processing complexity, and improving overall processing efficiency.

[0158] The B100 method, which "verifies data integrity at the receiving end of a large language model in the cloud and extracts all encrypted text fragments from the target data in response to an integrity verification pass command," specifically includes:

[0159] B111 parses data packets at the receiving end of the large language model in the cloud to obtain the received target data, Merkle tree, zero-knowledge proof of Merkle root, and digital signature corresponding to each text segment in the target data.

[0160] The receiving end of the cloud-based large language model uses the same zero-knowledge proof protocol to verify the zero-knowledge proof in the data packet and obtain the first verification result.

[0161] The receiving end of the cloud-based large language model receives data packets transmitted over the network. These packets contain the target data, the Merkle tree, zero-knowledge proofs of the Merkle root, and digital signatures corresponding to each text segment in the target data. The receiving end parses the packets according to a pre-agreed format. For example, the packets may have a fixed header containing the length and position information of each data segment. Based on this information, the receiving end extracts the target data, the Merkle tree, the zero-knowledge proofs of the Merkle root, and the digital signatures from the packets. The receiving end uses the same zero-knowledge proof protocol as the sending end to verify the zero-knowledge proofs in the packets. Zero-knowledge proofs are a method of proof that allows the prover to demonstrate the truth of a statement to the verifier without revealing any additional information. For example, the sending end proves the truthfulness of the Merkle root using a zero-knowledge proof protocol, and the receiving end verifies this proof to determine its validity, thus obtaining the first verification result.

[0162] By parsing data packets, the receiving end can obtain various key information required for data integrity verification, providing a foundation for subsequent verification steps; zero-knowledge proof verification can ensure the authenticity of Merklegen data without disclosing specific data, thus improving data security.

[0163] B112, recalculate the Merkle root of the target data at the receiving end of the large language model in the cloud, and denot it as the actual Merkle root;

[0164] The actual Merkle root is compared with the received Merkle root to obtain the second verification result.

[0165] Specifically, the receiving end recalculates the Merkle root based on the received target data. A Merkle tree is a binary tree where each leaf node is the hash value of a data block, and non-leaf nodes are the hash values ​​of their two child nodes. Following the Merkle tree construction algorithm, the receiving end calculates the hash value of the root node, i.e., the actual Merkle root, starting from each text segment of the target data. The recalculated actual Merkle root is compared with the received Merkle root. If they match, it indicates that the target data has not been tampered with during transmission; if they differ, it indicates that the data may have been tampered with. Through this comparison, the receiving end obtains a second verification result.

[0166] Merkle root comparison can effectively verify whether the target data has been tampered with during transmission; since the Merkle root is a hash digest of the target data, the Merkle root will be different as long as there is any slight change in the data, thus it can accurately detect data integrity problems.

[0167] B113, when both the first and second verification results meet the requirements, trigger the generation of an integrity verification pass instruction.

[0168] Specifically, the receiving end evaluates the first and second verification results. If the first verification result indicates that the zero-knowledge proof is valid, and the second verification result indicates that the actual Merkle root matches the received Merkle root, then both verification results are considered to meet the requirements. At this point, the receiving end triggers the generation of an integrity verification pass command, indicating that the integrity verification of the target data has passed. That is, in this embodiment, an integrity verification pass command is only generated when both verification results meet the requirements. This dual verification mechanism ensures that the integrity of the data is accurately verified and reduces the possibility of misjudgment.

[0169] In response to the integrity verification pass command, the receiver of the cloud-based large language model extracts all encrypted text fragments from the target data using the preset parsing rules that match the preset fusion rules.

[0170] Upon receiving the integrity verification successful command, the receiving end extracts all encrypted text fragments from the target data according to preset parsing rules. These preset parsing rules are an encrypted index table that records the position information of each encrypted text fragment within the target data. The receiving end uses this index table to locate and extract all encrypted text fragments from the target data. For example, the index table might record the start position and length of each text fragment, and the receiving end uses this information to extract the corresponding fragment from the target data. By using the encrypted index table, the receiving end can accurately extract all encrypted text fragments from the target data, avoiding unnecessary searching and filtering processes and improving extraction efficiency.

[0171] The preset parsing rule is an encrypted index table that matches the preset fusion rule. This index table records the position information of each encrypted text fragment in the target data.

[0172] Specifically, extracting all encrypted text fragments from the target data includes: identifying all encrypted disguised fragments from the target data based on the target information used to mark the corresponding disguised fragments, and separating all encrypted text fragments, that is, retaining only the fragments marked as real.

[0173] The method for B200, which "verifies the source legitimacy of all encrypted text fragments and decrypts all encrypted text fragments in response to a successful legitimacy verification instruction," includes:

[0174] B210 uses a preset public key corresponding to the preset private key of the local device to verify the digital signature of all encrypted text fragments at the receiving end of the cloud-based large language model, and obtains the first legitimacy verification result.

[0175] Specifically, when a local device establishes a connection with the cloud-based large language model, it generates a pre-set public-private key pair. The pre-set private key is securely stored on the local device, while the pre-set public key is uploaded to the receiving end of the cloud-based large language model. When the local device needs to send encrypted text fragments, it uses the pre-set private key to generate a digital signature for these text fragments, and then sends the encrypted text fragments and digital signatures together to the cloud. After receiving the data, the receiving end of the cloud-based large language model verifies the digital signature using the pre-stored pre-set public key. For example, if the digital signature is generated using the RSA algorithm, the cloud will decrypt the signature using the pre-set public key and compare it with the result of a hash operation on the original encrypted text fragment. If they match, it means the digital signature verification is successful, and the text fragment was indeed sent by the local device holding the corresponding private key.

[0176] This step ensures that the data is sent by a legitimate local device, preventing unauthorized devices from impersonating local devices and sending false data. Verifying the digital signature guarantees that the encrypted text fragment has not been tampered with during transmission, because if the data is tampered with, its hash value will change and will not match the result after the digital signature is decrypted.

[0177] B220 verifies the IP address of the sender corresponding to the data packet to obtain a second validity verification result.

[0178] Specifically, after receiving a data packet, the receiver of the cloud-based large language model extracts the sender's IP address from the packet. Then, it queries a pre-configured list of legitimate IP addresses. This list can be configured during system initialization or dynamically updated based on security policies. For example, when a local device is in normal use, its IP address is fixed or within a specific IP address range. The cloud checks whether the sender's IP address of the received data packet is in this legitimate list. If it is, the IP address verification is considered successful. This method prevents attacks from unauthorized network addresses. Even if an attacker obtains some information about the local device, the data packet will be intercepted if its IP address is not in the legitimate list. By restricting legitimate IP addresses, it ensures that only authorized network devices can communicate with the cloud-based large language model.

[0179] B230: When both the first and second validity verification results meet the requirements, a validity verification pass instruction is generated.

[0180] Specifically, the receiving end of the cloud-based large language model comprehensively judges the results of the first and second legitimacy verifications. If the digital signature verification passes (the first legitimacy verification result meets the requirements), and the sender's IP address is in the legitimate list (the second legitimacy verification result meets the requirements), the system will trigger a legitimacy verification pass instruction. This instruction can be an internal system signal or marker used to notify subsequent decryption operations. By combining digital signature verification and IP address verification, the accuracy and security of verification are improved. Only when both verifications pass is the data source considered legitimate, greatly reducing the risk of attack. A single verification method may result in false positives, while multiple verifications can complement each other, reducing the possibility of false positives.

[0181] B240, in response to a valid verification command, decrypts all encrypted text fragments.

[0182] Specifically, once the cloud-based large language model receives the authorization to pass the validity verification, it will invoke the corresponding decryption algorithm to decrypt the encrypted text fragment. After decryption, the original text content can be obtained for subsequent processing and use.

[0183] Decryption is only performed when the data source is legitimate, ensuring that the decrypted data is reliable and secure, and can be safely processed subsequently. Decryption is not performed when the legitimacy verification fails, preventing the leakage and processing of illegal data and protecting data privacy.

[0184] The method disclosed in this embodiment effectively prevents unauthorized device access and data tampering through a dual mechanism of digital signature verification and IP address verification, ensuring data security during transmission and storage. It ensures that the decrypted data originates from a legitimate source and has not been tampered with during transmission, improving data reliability and availability. In scenarios with stringent data security requirements, this multi-factor verification and decryption mechanism can help enterprises and organizations meet relevant security compliance standards. Furthermore, it allows for flexible security policy configuration by adjusting the list of legitimate IP addresses and the verification rules of digital signatures according to actual needs.

[0185] The B300 method, which "performs content integrity verification on all decrypted text fragments, and reassembles all decrypted text fragments in response to a successful integrity verification command to obtain the recovered input information," specifically includes:

[0186] 1) At the data sending end of the local device, a content fingerprint (i.e., original content fingerprint) is generated for each text segment (i.e., the original text segment) obtained after splitting. This content fingerprint is obtained by performing a special hash calculation on the content of each text segment. This hash calculation takes into account information such as the order and frequency of characters in the segment to ensure that even if there are slight changes in the content of the segment, they can be detected. These content fingerprints will be transmitted to the cloud (in encrypted form) together with the target data.

[0187] Each text fragment has a unique content fingerprint, just like its "ID card," which facilitates accurate content comparison and verification in the cloud. Because hash calculation takes into account information such as character order and frequency, even if a single character in the text fragment changes, the generated content fingerprint will be significantly different, thus enabling the detection of minute content changes.

[0188] 2) In the cloud-based large language model, the same content fingerprint calculation is performed on each decrypted text fragment to obtain the locally reconstructed content fingerprint.

[0189] Specifically, after receiving encrypted data, the cloud-based large language model first decrypts it to obtain decrypted text fragments. Then, it uses the same hash algorithm as the local device to calculate the content fingerprint of each decrypted text fragment. Using the same hash algorithm ensures that the locally reconstructed content fingerprint is comparable to the original content fingerprint. Only in this way can it accurately determine whether the content of the text fragment has changed. The cloud can independently verify the content of the text fragment without relying on additional information from the local device, thus improving the autonomy and reliability of the verification.

[0190] 3) Compare the locally reconstructed content fingerprint with the received original content fingerprint. If the content fingerprints of all decrypted text fragments match the original content fingerprints, the content integrity verification is successful, and an integrity verification success command is sent.

[0191] By comparing content fingerprints, it is possible to quickly and accurately determine whether a text fragment remains intact during transmission, or whether any content has been tampered with or lost. If the comparison does not match, it is possible to clearly identify which text fragment has a problem, facilitating further investigation and processing.

[0192] 4) After receiving the integrity verification pass instruction, reassemble all decrypted text fragments according to pre-agreed rules (such as the fragment numbering order).

[0193] For example, if the fragments are sent in ascending order of their numbers, they will be pieced together in the same order during reconstruction to obtain the restored input information. This method can accurately reconstruct the split text fragments into the original input information, ensuring data availability and consistency. Furthermore, the pre-defined reconstruction rules make the reconstruction process simple and efficient, avoiding confusion and errors.

[0194] In this embodiment, by comparing and verifying content fingerprints, any changes in the content of text fragments during transmission can be detected in a timely manner, ensuring that the recovered input information is consistent with the original information. Multiple verification mechanisms (encryption, decryption, and integrity verification) ensure the reliability of data throughout the entire transmission and processing process, reducing the risk of data errors and loss. Combined with the previous verification of the legality of the data source, data security is further guaranteed, preventing data from being tampered with or maliciously attacked. The method of splitting, transmitting, and reassembling text fragments enables data to be transmitted more efficiently between local devices and the cloud, while also facilitating distributed processing and storage of data.

[0195] Traditional solutions (such as fixed encryption or homomorphic encryption) suffer from high computational overhead, lack flexibility, cannot dynamically adjust encryption strategies, ignore multiple verifications after spoofing injection, are vulnerable to man-in-the-middle (MITM) attacks, rely on a single key for recovery, and lack privacy protection. The method disclosed in this application employs a three-layer verification mechanism: 1) Data integrity (extracting metadata and zero-knowledge proof information from the encrypted fragment to confirm it has not been tampered with); 2) Source legitimacy (verifying the encrypted signature to confirm the source and prevent impersonation); 3) Content integrity (separating the real / spoofed fragments, reassembling them in the original order, and performing content coherence verification). Bulletproofs protocol is used for verification in the ciphertext space. For the recovery scheme, the real fragment is separated in the cloud, and only correctly marked decryptions are checked for content integrity (matching checksums). Unlike existing "fixed encryption," this solution integrates a closed loop of "context-adaptive encryption + spoofing injection + zero-knowledge proof," reducing the risk of data leakage by 95%, supporting log recording and alerts (attachment verification: 100% data integrity guarantee), and effectively improving security and efficiency compared to single encryption (reducing computational overhead by 60%). In a public cloud environment, it is resistant to quantum attacks (Kyber-1024) and can be integrated with other modules of DTCL-AI to improve overall efficiency (40% reduction in response latency), making it applicable to fields such as healthcare, finance, and law.

[0196] Reference Figure 5 Secondly, this application discloses an input data protection method, comprising:

[0197] S10, in response to the question-and-answer request, the local device splits the user's input information into several text fragments, calls the corresponding level of encryption policy according to the importance of each text fragment, and performs encryption.

[0198] Retrieve all encrypted text fragments.

[0199] S20, generate several disguised fragments that are similar to the distribution of all encrypted text fragments;

[0200] S30, each disguised segment is encrypted with an independent encryption key and the disguised segment is marked using a preset method;

[0201] S40, according to the preset fusion rules, merge all the encrypted disguised fragments with all the encrypted text fragments to obtain the input data after privacy protection processing.

[0202] Specifically, suppose a user inputs medical record information containing basic patient information, symptom descriptions, and past medical history into a large-scale language model app in the medical field. The local device breaks this input information down into multiple text segments such as "patient name," "age," "symptom presentation," and "past major illness history." For the highly sensitive segment "past major illness history," a strong encryption algorithm, such as AES-256, is used because this information is highly sensitive and its leakage could have serious consequences for the patient. For relatively less sensitive information, such as "age," a weaker encryption algorithm, such as AES-128, is used. Using different levels of encryption strategies for text segments of different importance ensures the security of sensitive information while improving encryption efficiency to some extent. This avoids the performance loss caused by using high-strength encryption for all information. In a public cloud environment, even if the data is maliciously intercepted during the upload process, the high-strength encryption of some important information makes it difficult for attackers to obtain valuable content, thus protecting the user's privacy and sensitive information.

[0203] Continuing with the example of medical records, suppose there are five encrypted text fragments, each with a certain distributional pattern in length and format. The local device will generate disguised fragments that are similar to these encrypted text fragments in length and format. For example, it might generate fragments that appear to be patient information but are actually fake, such as "fake patient name" or "fictitious symptoms." These disguised fragments share similar distributional characteristics with the real encrypted text fragments, such as similar length and identical data type. In a public cloud environment, if an attacker attempts to intercept the data, they will see a large number of similarly distributed fragments, making it difficult to distinguish between genuine encrypted text fragments and disguised fragments. This increases the difficulty for attackers to obtain the real information and further enhances information security.

[0204] For each generated fake fragment, the local device encrypts it using a different encryption key. For example, the "fake patient name" fragment is encrypted with AES using key K1, and the "fake symptom presentation" fragment is encrypted with key K2. Simultaneously, fake fragments are marked using a preset method, such as adding a specific identifier like "#F" at the beginning of the fragment. This identifier is also encrypted, allowing the local device to identify the fake fragment during subsequent processing. Each fake fragment uses an independent encryption key, so even if an attacker cracks the encryption key of one fake fragment, they cannot obtain information about other fake fragments, increasing the difficulty of cracking. By marking fake fragments using a preset method, the local device can easily identify the fake fragments and perform correct operations during subsequent fusion and processing.

[0205] In this embodiment, the preset fusion rule can be to alternately arrange the disguised fragments and encrypted text fragments in a certain order. For example, the encrypted real text fragments are labeled as T1, T2, T3, etc., and the encrypted disguised fragments are labeled as F1, F2, F3, etc., and fused in the order of T1-F1-T2-F2-T3-F3. This yields the privacy-protected input data, which is then uploaded to the large language model APP on the public cloud platform. In the fused input data, the real encrypted text fragments and disguised fragments are mixed together, making it more difficult for attackers to extract the real information, further improving the security of the data during transmission. In a public cloud environment, this fusion method makes the data more difficult to identify and crack during the upload process, meeting the secure transmission needs of industries with extremely high data confidentiality requirements.

[0206] By employing different levels of encryption strategies for text fragments of varying importance, generating disguised fragments, independently encrypting and disguising these fragments, and then merging them, the difficulty for attackers to obtain genuine information is significantly increased. This effectively reduces the risk of information being maliciously intercepted or misused, protecting user privacy and sensitive information. In public cloud environments, users are more willing to upload data to large language model apps that employ this input data protection method because they have greater confidence in the security of their data, thereby improving the credibility of model applications. Because the input data is effectively protected, the possibility of data being maliciously tampered with or having backdoors introduced is reduced during the training and fine-tuning of large models, improving the security of model training and fine-tuning.

[0207] Thirdly, this application discloses a privacy protection architecture for input data of large language models, deployed on the periphery of the large language model, the architecture comprising:

[0208] The receiving unit is used to receive user input information;

[0209] The dynamic fragment encryption unit is used to split the input information into several text fragments, call the corresponding level of encryption policy according to the importance of each text fragment and perform encryption, and obtain all the encrypted text fragments, which are recorded as encrypted data;

[0210] The disguised fragment generation unit is used to generate several disguised fragments that are similar to the distribution of all encrypted text fragments.

[0211] The disguised fragment encryption unit is used to encrypt each disguised fragment with an independent encryption key and to mark the disguised fragments using a preset method;

[0212] The fusion unit is used to fuse all encrypted disguised fragments with all encrypted text fragments according to preset fusion rules to obtain the target data;

[0213] The sending unit is equipped with API interfaces adapted to various large language models, which are used to send target data to the receiving end of the corresponding large language model in the cloud.

[0214] In this embodiment, the receiving unit is responsible for receiving user input information. Regardless of the device the user uses (such as a computer, mobile phone, etc.), the receiving unit can collect this information to prepare for subsequent processing. As the entry point for the entire privacy protection architecture, the unified reception of user input information provides a clear starting point for subsequent data processing. This helps to centrally manage and process user input information, avoids management chaos caused by scattered information, and improves the efficiency and accuracy of data processing.

[0215] The dynamic fragmentation encryption unit breaks down the received input information into several text segments. Based on the importance of each segment, it applies an encryption strategy of corresponding level to encrypt it, ultimately obtaining all the encrypted text segments (i.e., encrypted data). Different levels of encryption strategies are used for text segments of different importance; high-strength encryption is used for sensitive information, while relatively low-strength encryption is used for general information. This ensures the security of sensitive information while improving encryption efficiency and reducing resource consumption during the encryption process. Furthermore, in a public cloud environment, information is easily intercepted during transmission. By applying different levels of encryption to different segments, even if the data is intercepted, attackers will find it difficult to easily decipher valuable sensitive information, thus effectively protecting user privacy and sensitive data.

[0216] The spoofing fragment generation unit generates several spoofed fragments that resemble the distribution of all encrypted text fragments. These spoofed fragments are similar to the encrypted text fragments in length, format, and other aspects. In a public cloud environment, attackers attempting to intercept data to obtain genuine information can be confuse by these spoofed fragments, making it difficult for them to distinguish between genuine encrypted text fragments and spoofed fragments. This increases the difficulty for attackers to obtain the true information, further enhancing data security.

[0217] The camouflage fragment encryption unit encrypts each camouflage fragment using an independent encryption key and marks the camouflage fragments using a preset method. Each camouflage fragment uses an independent encryption key, so even if an attacker cracks the encryption key of one camouflage fragment, they cannot obtain information about the other camouflage fragments, greatly increasing the difficulty of cracking. Simultaneously, by marking the camouflage fragments using the preset method, the system can easily identify the camouflage fragments during subsequent fusion and data processing, ensuring the accuracy and efficiency of data processing.

[0218] The fusion unit is used to merge all encrypted disguised fragments with all encrypted text fragments according to preset fusion rules to obtain the target data. In the fused target data, real encrypted text fragments and disguised fragments are mixed together, making it more difficult for attackers to extract real information. This further enhances the security of the data during transmission and meets the security needs of industries with extremely high data confidentiality requirements (such as the legal and medical fields).

[0219] The sending unit is equipped with API interfaces adapted to various large language models, used to send target data to the corresponding cloud-based large language model's receiving end. These API interfaces allow the privacy-preserving architecture to interface with different cloud-based large language models, providing broad applicability. Regardless of the large language model used by the user, the architecture can accurately send the processed target data to the appropriate receiving end. After processing by the preceding units, the sent target data already possesses a high level of security. The secure transmission of the data to the cloud-based large language model via the sending unit ensures the confidentiality and integrity of the data throughout the entire transmission process.

[0220] This architecture constructs a multi-layered security protection system through a series of operations, including dynamic fragment encryption, generation of disguised fragments, encryption of disguised fragments, and fusion processing. This effectively reduces the risk of information being maliciously intercepted or misused in a public cloud environment, protecting user privacy and sensitive information. Users have greater confidence in the security of their data when using large language models because they know their input information has undergone strict privacy protection processing. This helps improve the credibility of large language model applications, attracting more users and enterprises. Because the input data is effectively protected, the possibility of malicious data tampering or backdoor introduction during the training and fine-tuning of large models is reduced, improving the security of model training and fine-tuning, and ensuring the normal operation of the model and the reliability of the output results.

[0221] Compared to existing encryption technologies (such as isomorphic encryption) and federated learning methods, this architecture solves the problem of excessive computational overhead in encryption technologies while meeting the diverse needs of large public cloud models, overcoming the obvious limitations of existing methods. Existing methods generally lack dynamic monitoring of model behavior trustworthiness, while this architecture, through comprehensive privacy protection of input data, gives users greater confidence in data security, thereby improving the trustworthiness of large language model applications. Users are more willing to entrust sensitive data to systems using this architecture, fundamentally enhancing the overall trustworthiness of AI systems. The architecture's compatibility and flexibility mean that large-scale modifications to core code are unnecessary when replacing large models, reducing application development and maintenance costs. Simultaneously, robust privacy protection mechanisms reduce the risk of data leakage and malicious exploitation, providing enterprises and users with a safer and more reliable usage environment.

[0222] Fourthly, this application discloses a model interaction system based on input data protection, used to execute the model interaction method based on input data protection disclosed in the first aspect of this application. The system specifically includes:

[0223] The split encryption module is used to respond to a question-and-answer request by splitting the user's input information into several text fragments on the local device, calling the corresponding level of encryption policy and performing encryption according to the importance of each text fragment, and then obtaining all the encrypted text fragments.

[0224] The disguised fragment generation module is used to generate several disguised fragments that are similar to the distribution of all encrypted text fragments.

[0225] The disguised fragment encryption module is used to encrypt each of the disguised fragments using an independent encryption key and to mark the disguised fragments using a preset method;

[0226] The fusion module is used to fuse all the encrypted disguised fragments with all the encrypted text fragments according to a preset fusion rule to obtain the target data;

[0227] The sending module is used to send the target data to the cloud-based large language model;

[0228] The verification module is used to verify the data integrity, source legality, and content integrity of the target data through the receiving end of the cloud-based large language model. When all verifications pass, the restored input information is obtained.

[0229] The response module is used to call the processing end of the cloud-based large language model to process the recovered input information and generate feedback content. Furthermore, the generated feedback content is sent back to the device on which the user input the information for easy viewing.

[0230] Suppose a company has developed an intelligent question-answering system for the medical field. This system needs to use a large language model to generate accurate medical knowledge answers. To flexibly select different large language models and avoid extensive code modifications caused by changing the large model, the company can develop middleware. When a user enters a medical question into the system, the system sends the question to the middleware. The middleware selects an appropriate large language model based on its configuration and sends the question to it through the large language model's API. After processing the question, the large language model returns the answer, which the middleware then returns to the intelligent question-answering system for final presentation to the user. If the large language model needs to be changed later, only the corresponding configuration needs to be modified in the middleware, without requiring large-scale changes to the core code of the intelligent question-answering system.

[0231] A computer device according to embodiments of the present disclosure includes a memory and a processor. The memory is used to store non-transitory computer-readable instructions. Specifically, the memory may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may, for example, include random access memory (RAM) and / or cache memory. The non-volatile memory may, for example, include read-only memory (ROM), hard disk, flash memory, etc.

[0232] The processor may be a central processing unit (CPU) or other processing unit with data processing capabilities and / or instruction execution capabilities, and may control other components in the computer device to perform desired functions. In one embodiment of this disclosure, the processor is used to execute computer-readable instructions stored in the memory, causing the computer device to perform all or part of the steps of the input data protection-based model interaction method or input data protection method of the foregoing embodiments of this disclosure.

[0233] Those skilled in the art will understand that, in order to solve the technical problem of how to achieve a good user experience, this embodiment may also include well-known structures such as communication buses and interfaces, and these well-known structures should also be included within the protection scope of this disclosure.

[0234] like Figure 5 This is a schematic diagram of a computer device provided for an embodiment of the present disclosure. It illustrates a structural schematic diagram suitable for implementing the computer device in the embodiments of the present disclosure. Figure 5 The computer device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0235] like Figure 5 As shown, a computer device may include a processor (such as a central processing unit, graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) or programs loaded from storage devices into random access memory (RAM). The RAM also stores various programs and data required for the operation of the computer device. The processor, ROM, and RAM are interconnected via a bus. Input / output (I / O) interfaces are also connected to the bus.

[0236] Typically, the following devices can be connected to the I / O interface: input devices, such as sensors or visual information acquisition devices; output devices, such as displays; storage devices, such as magnetic tapes or hard drives; and communication devices. Communication devices allow the computer device to communicate wirelessly or wiredly with other devices (such as edge computing devices) to exchange data. Although Figure 5 A computer apparatus with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0237] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device, or installed from a ROM. When the computer program is executed by a processor, all or part of the steps of the input data protection-based model interaction method or input data protection method of embodiments of this disclosure are performed.

[0238] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0239] A computer-readable storage medium according to embodiments of the present disclosure stores non-transitory computer-readable instructions. When these non-transitory computer-readable instructions are executed by a processor, all or part of the steps of the input data protection-based model interaction method or input data protection method described in the foregoing embodiments of the present disclosure are performed.

[0240] The aforementioned computer-readable storage media include, but are not limited to: optical storage media (e.g., CD-ROM and DVD), magneto-optical storage media (e.g., MO), magnetic storage media (e.g., magnetic tape or portable hard drive), media with built-in rewritable non-volatile memory (e.g., memory card), and media with built-in ROM (e.g., ROM cartridge).

[0241] For a detailed description of this embodiment, please refer to the corresponding descriptions in the foregoing embodiments, which will not be repeated here.

[0242] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0243] In this disclosure, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The block diagrams of devices, apparatuses, devices, and systems involved in this disclosure are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as "comprising," "including," "having," etc., are open-ended terms meaning "including but not limited to," and are used interchangeably with them. The terms "or" and "and" as used herein refer to the terms "and / or," and are used interchangeably with them unless the context clearly indicates otherwise. The term "such as" as used herein refers to the phrase "such as but not limited to," and is used interchangeably with it.

[0244] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0245] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0246] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0247] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0248] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A model interaction method based on input data protection, characterized in that, The method comprises the following steps: in response to a question and answer request, the local device splits the user's input information into several text segments, and according to the importance of each text segment, a corresponding level of encryption strategy is called and encryption is performed; generate a plurality of camouflage segments similar to the distribution of all encrypted text segments; each of the camouflage segments is encrypted using an independent encryption key, and the camouflage segments are marked using a preset method; fuse all encrypted camouflage segments with all encrypted text segments according to a preset fusion rule to obtain target data; send the target data to a cloud large language model; verify the target data through the receiving end of the cloud large language model for data integrity, source legality and content integrity, and obtain the restored input information after passing all verifications; call the processing end of the cloud large language model to process the restored input information and generate demand feedback content; the method for generating a plurality of camouflage segments similar to the distribution of all encrypted text segments comprises: extracting features from each encrypted text segment to obtain corresponding target features, and converting the target features into high-dimensional feature vectors; store all high-dimensional feature vectors corresponding to the encrypted text segments in a first vector set; divide all high-dimensional feature vectors in the first vector set to obtain a plurality of batches; use the random gradient descent method to iteratively update the parameters of the variational autoencoder when the preset loss function is minimized to obtain the trained variational autoencoder; use a random number generator to sample M latent vectors from the latent space of the trained variational autoencoder according to a preset number of camouflage segments; wherein the preset number of camouflage segments is M, and the prior distribution of the latent space of the trained variational autoencoder is a standard normal distribution; input the latent vectors into the trained decoder network to obtain M reconstructed feature vectors; convert all reconstructed feature vectors back to text representation to obtain M camouflage segments; the method for encrypting each of the camouflage segments using an independent encryption key and marking the camouflage segments using a preset method comprises: generate a pair of keys for each of the camouflage segments, including a camouflage public key and a camouflage private key; encrypt each of the camouflage segments using the camouflage public key, and mark the encrypted camouflage segments as camouflage encrypted segments; calculate the hash value of each of the camouflage encrypted segments; generate a random number using a random number generator; combine the hash value and the random number into target information, and mark the corresponding camouflage segment with the target information.

2. The model interaction method based on input data protection according to claim 1, characterized in that, the method for splitting the user's input information into several text segments in the local device, and according to the importance of each text segment, a corresponding level of encryption strategy is called and encryption is performed, comprising: the local device splits the user's input information into several text segments using natural language processing technology; use natural language processing algorithms to analyze the keywords of each text segment to determine the sensitivity level of each text segment; Corresponding encryption strategies are called from an encryption strength level database based on each of the sensitivity levels; When the sensitivity level is level one, the corresponding encryption strategy is a level one encryption strategy; when the sensitivity level is level two, the corresponding encryption strategy is a level two encryption strategy; and when the sensitivity level is level three, the corresponding encryption strategy is a level three encryption strategy; Encryption of the text segments is performed according to the corresponding encryption strategies, and metadata of each of the text segments is digitally signed using a preset private key.

3. The model interaction method based on input data protection according to claim 1, characterized in that, The fusing of all the encrypted camouflage segments and all the encrypted text segments according to a preset fusion rule to obtain target data includes: A first sequence of all the encrypted text segments is determined according to a first preset rule; A second sequence of all the encrypted camouflage segments is determined according to a second preset rule; A hash value of each of the encrypted camouflage segments is obtained, denoted as a camouflage hash value; A camouflage random number is generated by a random number generator; An offset of each of the encrypted camouflage segments is determined based on the camouflage random number, the camouflage hash value, and a preset camouflage formula; No. The encrypted disguised fragment The corresponding offset is : ,in, For the first The encrypted disguised fragment The fake hash value, For the preset offset range, To disguise random numbers; An insertion position of each of the encrypted camouflage segments in the first sequence is determined according to an order of each of the encrypted camouflage segments in the second sequence and the corresponding offset; Camouflage injection of the corresponding encrypted camouflage segment in the first sequence is performed based on the insertion position, until injection of all the encrypted camouflage segments is completed, to obtain target data.

4. The model interaction method based on input data protection according to claim 3, characterized in that, The sending of the target data to a cloud large language model includes: The target data is divided into multiple data blocks, and a hash value of each of the data blocks is calculated to form a hash list; A Merkle tree is constructed at a sending end of a local device based on the hash list; the Merkle tree is a binary tree structure, each leaf node is a hash value of a data block, a non-leaf node is a hash of hash values of two child nodes, and a Merkle root of the tree represents an abstract of the entire target data; Zero-knowledge proof of the Merkle root is generated by the sending end of the local device using a zero-knowledge proof protocol; The target data, the Merkle tree, zero-knowledge proof of the Merkle root, and digital signatures corresponding to each of the text segments in the target data are packaged into a data packet and sent to a receiving end of the cloud large language model.

5. The model interaction method based on input data protection according to claim 4, characterized in that, The target data is verified for data integrity, source legality, and content integrity by the receiving end of the cloud large language model, and the recovered input information is obtained after all the verifications are passed, including: Verification of data integrity is performed at the receiving end of the cloud large language model, and all the encrypted text segments are extracted from the target data in response to an integrity verification pass instruction; Source legality verification is performed on all the encrypted text segments, and decryption is performed on all the encrypted text segments in response to a legality verification pass instruction; Content integrity check is performed on all the decrypted text segments, and the recovered input information is obtained by recombining all the decrypted text segments in response to an integrity check pass instruction.

6. The model interaction method based on input data protection according to claim 5, characterized in that, Verifying data integrity at the receiving end of the cloud large language model, in response to an integrity verification pass instruction, extracting all encrypted text segments from the target data, including: At the receiving end of the cloud large language model, parse the data packet to obtain the received target data, the zero-knowledge proof of the Merkle tree and the Merkle root, and the digital signature corresponding to each text segment in the target data; The receiving end of the cloud large language model uses the same zero-knowledge proof protocol to verify the zero-knowledge proof in the data packet to obtain a first verification result; Recalculate the Merkle root of the target data at the receiving end of the cloud large language model, denoted as the actual Merkle root; Compare the actual Merkle root with the received Merkle root to obtain a second verification result; When the first verification result and the second verification result both meet the requirements, trigger the generation of an integrity verification pass instruction; In response to the integrity verification pass instruction, the receiving end of the cloud large language model and the pre-set analysis rule matching the pre-set fusion rule extract all encrypted text segments from the target data.

7. The model interaction method based on input data protection according to claim 6, characterized in that, The source legality verification of all encrypted text segments, in response to the legality verification pass instruction, includes: At the receiving end of the cloud large language model, use the pre-set public key corresponding to the pre-set private key of the local device to verify the digital signature of all encrypted text segments to obtain a first legality verification result; Verify the IP address of the sending end corresponding to the data packet to obtain a second legality verification result; When the first legality verification result and the second legality verification result both meet the requirements, trigger the generation of a legality verification pass instruction; In response to the legality verification pass instruction, decrypt all encrypted text segments.

8. An input data protection method for input data protection in a public cloud environment, characterized by, The method comprises: In response to a question and answer request, split the user's input information into several text segments at the local device, and call the encryption strategy of the corresponding level according to the importance of each text segment and perform encryption; Generate several camouflage segments similar in distribution to all encrypted text segments; Encrypt each camouflage segment with an independent encryption key and mark the camouflage segment with a pre-set method; Fuse all encrypted text segments with all encrypted camouflage segments according to a pre-set fusion rule to obtain input data after privacy protection processing; The method comprises: Perform feature extraction on each encrypted text segment to obtain the corresponding target feature, and convert the target feature into a high-dimensional feature vector; Store all high-dimensional feature vectors corresponding to all encrypted text segments into a first vector set; Divide all high-dimensional feature vectors in the first vector set to obtain several batches; The corresponding high-dimensional feature vectors of several batches are used as inputs of the variational autoencoder, and the parameters of the variational autoencoder are iteratively updated using the stochastic gradient descent method, and the trained variational autoencoder is obtained when the preset loss function is minimized; According to the preset number of camouflage fragments, a random number generator is used to sample M latent vectors from the latent space of the trained variational autoencoder; wherein the preset number of camouflage fragments is M, and the prior distribution of the latent space of the trained variational autoencoder is a standard normal distribution; The latent vectors are input into the trained decoder network to obtain M reconstructed feature vectors; All the reconstructed feature vectors are converted back to text representation to obtain M camouflage fragments; Each of the camouflage fragments is encrypted using an independent encryption key, and the camouflage fragments are marked using a preset method, including: A pair of keys is generated for each of the camouflage fragments, including a camouflage public key and a camouflage private key; Each of the camouflage fragments is encrypted using the camouflage public key, and the encrypted camouflage fragments are denoted as camouflage encrypted fragments; The hash value of each of the camouflage encrypted fragments is calculated; A random number is generated by a random number generator; The hash value and the random number are combined into target information, and the corresponding camouflage fragments are marked with the target information.

9. A privacy shield architecture for large language model input data, characterized in that, Deployed in the periphery of a large language model, the architecture includes: A receiving unit for receiving input information from a user; A dynamic fragmentation encryption unit for splitting the input information into several text fragments, calling an encryption strategy of a corresponding level according to the importance of each text fragment and performing encryption to obtain all encrypted text fragments, denoted as encrypted data; A camouflage fragment generation unit for generating several camouflage fragments similar in distribution to all encrypted text fragments; A camouflage fragment encryption unit for encrypting each of the camouflage fragments using an independent encryption key and marking the camouflage fragments using a preset method; A fusion unit for fusing all encrypted camouflage fragments and all encrypted text fragments according to a preset fusion rule to obtain target data; A sending unit configured with API interfaces adapted to various large language models for sending target data to a receiving end of a corresponding cloud large language model; The generation of several camouflage fragments similar in distribution to all encrypted text fragments includes: Feature extraction is performed on each encrypted text fragment to obtain corresponding target features, and the target features are converted into high-dimensional feature vectors; All high-dimensional feature vectors corresponding to encrypted text fragments are stored in a first vector set; All high-dimensional feature vectors in the first vector set are divided to obtain several batches; The corresponding high-dimensional feature vectors of several batches are used as inputs of the variational autoencoder, and the parameters of the variational autoencoder are iteratively updated using the stochastic gradient descent method, and the trained variational autoencoder is obtained when the preset loss function is minimized; According to a preset number of camouflage fragments, M latent vectors are sampled from the latent space of the trained variational autoencoder using a random number generator; wherein the preset number of camouflage fragments is M, and the prior distribution of the latent space of the trained variational autoencoder is a standard normal distribution; The latent vectors are input into the trained decoder network to obtain M reconstructed feature vectors; All the reconstructed feature vectors are converted back to text representation to obtain M camouflage fragments; Each of the camouflage fragments is encrypted using an independent encryption key, and the camouflage fragments are marked using a preset method, including: A pair of keys is generated for each of the camouflage fragments, including a camouflage public key and a camouflage private key; Each of the camouflage fragments is encrypted using the camouflage public key, and the encrypted camouflage fragments are denoted as camouflage encrypted fragments; The hash value of each of the camouflage encrypted fragments is calculated; A random number is generated by a random number generator; The hash value and the random number are combined into target information, and the corresponding camouflage fragments are marked with the target information.

10. A computer apparatus, comprising: The computer device includes: At least one processor; and A memory connected in communication with the at least one processor; wherein The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the model interaction method based on input data protection of any one of claims 1-7 or the input data protection method of claim 8.

11. A computer readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing a computer to execute the model interaction method based on input data protection of any one of claims 1-7 or the input data protection method of claim 8.

12. A computer program product comprising computer instructions, characterized in that, The computer instructions, when executed by a processor, implement the steps of the model interaction method based on input data protection of any one of claims 1-7 or the input data protection method of claim 8.

Images